Extending Secure Ethernet Connectivity From the Industrial Edge to the Cloud

Industrial networks are under pressure to deliver more than deterministic control. Equipment builders now need to secure connectivity between distributed sensors, motor-control nodes and cloud infrastructure without adding layers of protocol gateways, custom wiring and isolated monitoring systems. Our “Secure Gateway Architecture for 10BASE-T1S SPE Client Networks With AWS^® Cloud Demonstration Application” addresses this challenge by combining 10BASE-T1S Single Pair Ethernet (SPE), secure microcontrollers (MCUs) and Wi-Fi^® cloud connectivity into a unified edge-to-cloud architecture.

Connecting Operational Technology to the Cloud

At the center of the reference design is a practical demonstration of secure remote motor control and monitoring over the cloud. Rather than treating operational technology (OT) systems as isolated islands, the design shows how industrial Ethernet can extend from edge devices directly into cloud-connected infrastructure while maintaining a scalable and manageable network topology.

Reducing Network Complexity

One of the key engineering challenges in industrial automation is connecting multiple distributed devices without increasing system complexity. Traditional architectures often require several additional components to bridge edge devices into Ethernet or cloud environments, including:

• Separate fieldbus systems
• Protocol converters
• Dedicated gateways

Each adds hardware cost, cabling and maintenance overhead.

Multidrop Ethernet Over a Single Pair

The reference design uses 10BASE-T1S Ethernet to simplify that architecture. Defined under IEEE 802.3, 10BASE-T1S enables multidrop Ethernet communication over a single twisted pair. Multiple nodes can share the same network segment, reducing the number of cables, switch ports and connectors required across a machine or factory subsystem. Microchip notes that 10BASE-T1S supports multidrop communication with at least eight transceiver nodes on a common segment extending up to at least 25 meters.

The table below compares this approach with traditional industrial networking architectures:

Bringing Ethernet to Cost-Sensitive Edge Nodes

The design demonstrates this concept using the LAN8651 10BASE-T1S MAC-PHY Ethernet controller. The LAN8651 integrates both the Ethernet MAC and PHY while communicating with host MCUs over SPI, making it practical to add Ethernet connectivity to cost-sensitive embedded systems that may not include a dedicated Ethernet MAC. This approach allows distributed motor-control or sensing nodes to participate in standard Ethernet communication without requiring complex networking hardware.

Hardware-Assisted Security

Security is another major focus of the design. As industrial systems become cloud connected, embedded devices increasingly need hardware-assisted security for authentication, encryption and secure firmware management. The gateway architecture uses the PIC32CK SG MCU family, which combines an Arm^® Cortex^®-M33 core with TrustZone^® technology and an integrated Hardware Security Module (HSM).

According to Microchip documentation, HSM provides:

• Cryptographic acceleration
• Secure key storage
• True random number generation

These support functions such as Secure Boot, Secure TLS and encryption. TrustZone technology helps isolate critical software and security functions from the rest of the application environment. In a connected industrial deployment, this hardware-based isolation becomes important for protecting cloud credentials, communication channels and firmware integrity.

An Edge-to-Cloud Connectivity Model

The cloud connectivity portion of the demonstration is enabled through the RNWF02 Wi-Fi module and AWS cloud integration. The design illustrates how data from distributed 10BASE-T1S motor-control nodes can be aggregated through the secure gateway and transmitted wirelessly for remote monitoring and control. Instead of relying on fragmented OT communication paths, the architecture creates an IP-based connectivity model from the edge node to the cloud.

Key Takeaway

For developers building next-generation industrial equipment, the reference design offers a working example of how secure embedded processing, cloud connectivity and simplified Ethernet networking can coexist in a scalable architecture. Rather than treating cloud integration as an external add-on, the design incorporates security, networking and edge control into a cohesive system built around standard Ethernet communication. As industrial networks continue moving toward unified OT and IT connectivity, architectures based on 10BASE-T1S and secure embedded gateways may play an important role in bringing Ethernet all the way to the edge of distributed control systems.

Reference Design: Secure Gateway Architecture for 10BASE-T1S SPE Client Networks With AWS^® Cloud Demonstration Application | Reference Design | Microchip Technology

FAQ

What is 10BASE-T1S Single Pair Ethernet (SPE)?

10BASE-T1S is an Ethernet standard defined under IEEE 802.3 that enables multidrop Ethernet communication over a single twisted-pair cable. Unlike traditional point-to-point Ethernet connections, multiple nodes can share the same network segment, helping reduce cabling, connectors and switch requirements in industrial systems.

How does 10BASE-T1S differ from traditional industrial fieldbus networks?

Traditional fieldbus systems often require specialized gateways or protocol translation to connect operational technology (OT) devices into Ethernet or cloud-based infrastructure. 10BASE-T1S allows distributed edge devices to communicate using standard Ethernet protocols directly, simplifying integration with modern IP-based industrial and cloud networks.

Why use multidrop SPE instead of conventional switched Ethernet for edge nodes?

Conventional Ethernet architectures typically require separate switch ports and cabling for each connected node. Multidrop SPE allows several devices to share a common network segment, which can reduce wiring complexity, lower installation costs and simplify network expansion inside industrial equipment.

What types of industrial devices benefit from 10BASE-T1S connectivity?

10BASE-T1S can be useful for distributed motor-control nodes, industrial sensors, actuator modules, machine-health monitoring systems and other embedded edge devices that need Ethernet connectivity without the cost or complexity of full switched Ethernet infrastructure.

How does the secure gateway architecture support cloud-connected industrial systems?

The architecture aggregates data from distributed 10BASE-T1S edge nodes through a secure embedded gateway and transmits data to cloud infrastructure using Wi-Fi connectivity. This creates a unified edge-to-cloud communication path for remote monitoring, diagnostics and control applications.

Why is hardware-based security important in industrial Ethernet gateways?

As OT systems become connected to cloud services, gateways increasingly need secure key storage, authentication and firmware protection. Hardware-assisted security technologies such as Secure Boot, TrustZone isolation and Hardware Security Modules (HSMs) help protect communication channels, firmware integrity and cloud credentials from unauthorized access or tampering.